---
id: "CVE-2026-110090"
page: "https://infrastack.ai/live/CVE-2026-110090"
kind: "vulnerability"
aliases: ["CVE-2026-110090"]
title: "Premiere Pro: path traversal lets an attacker read arbitrary files"
severity: "high"
cvss: 7.1
epss: null
exploited: false
status: "open"
category: "vendor"
products: [{"name": "Adobe Premiere", "fixed": ["26.5.3", "27.0"], "affected": "<= 26.5.2; <= 25.6.6", "ecosystem": "vendor"}]
ecosystems: []
tags: ["adobe", "local", "macos", "premiere-pro", "vendor", "windows"]
not_affected_if: ["patched-26.5.3-or-27.0", "unknown"]
published_at: "2026-11-10T21:18:20+00:00"
first_seen_at: "2026-11-10T21:46:09+00:00"
updated_at: "2026-11-10T22:02:25+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-110090", "first_seen_at": "2026-11-10T21:46:09+00:00"}, {"source": "analyst", "url": "https://www.adobe.com/trust/security/products/premiere/apsb26-101.html", "first_seen_at": "2026-11-10T22:02:25+00:00", "cites": ["https://www.adobe.com/trust/security/products/premiere/apsb26-101.html"]}]
exploit_sources: []
---

# Premiere Pro: path traversal lets an attacker read arbitrary files

Link for people: https://infrastack.ai/live/CVE-2026-110090 (this .md is for agents)

Adobe Premiere Pro has a path traversal flaw that lets an attacker read files and directories outside the intended folder. The sources say no user interaction is needed and the scope is changed; CVSS rates it 7.1 (high).

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Adobe Premiere affected <= 26.5.2; <= 25.6.6 fixed 26.5.3, 27.0

## How to check

In Premiere, Help > About Premiere Pro (or Creative Cloud app). Exposed if version is 26.5.2 or earlier, or 25.6.6 or earlier (Windows and macOS). Not exposed on 26.5.3 or 27.0 and later.

## Fix

Update Adobe Premiere to 26.5.3 (26.x line) or 27.0 via Creative Cloud / Download Center. Premiere 25.6.x has no 25.x fix listed; move to 26.5.3 or 27.0.

## Timeline

- 2026-11-10T21:46:09+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-110090
- 2026-11-10T22:02:25+00:00 analyst https://www.adobe.com/trust/security/products/premiere/apsb26-101.html — Adobe APSB26-101 (Nov 10 2026) read: affected Premiere <=26.5.2 and <=25.6.6; fixed 26.5.3 and 27.0; CVSS vector AV:L, no exploit known to Adobe. Bulletin does not say how the file read is triggered (project file or otherwise).

## Documents

- [advisory] Adobe Premiere APSB26-101 https://www.adobe.com/trust/security/products/premiere/apsb26-101.html

## From the sources

Premiere Pro is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability to access sensitive files and directories outside the intended access scope. Exploitation of this issue does not require user interaction. Scope is changed.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_